filter {
  if 'logstash' in [fileset][module] {
    dissect {
      mapping => {
        "message" => "[%{[logstash][log][timestamp]}][%{[logstash][log][level]}][%{[logstash][log][module]}]%{[logstash][log][message]}"
      }
      remove_field => "message"
    }
    date {
      match => ["[logstash][log][timestamp]", "ISO8601"]
      remove_field => "[fw][timestamp]"
    }
    mutate {
      strip => "[logstash][log][level]"
      strip => "[logstash][log][module]"
      strip => "[logstash][log][message]"
    }
  }
}
